consumed the event stream, ran anomaly detection models, and published detection signals when anomalies were identified.